BaseFortify

Publication date: 2025-12-03

Last updated on: 2025-12-04

Assigner: MITRE

Description

WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-03

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66431

EUVD

EUVD-2025-200986

Affected Vendors & Products

Vendor	Product	Version / Range
redis	redis	6.3.0
webpros	plesk	*
php	php	8.5.0
owasp	modsecurity_crs	4.19.0
phpmyadmin	phpmyadmin	5.2.3
passenger	passenger	6.1.0
openssl	openssl	3.0.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-61	The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

Executive Summary

This vulnerability in WebPros Plesk versions before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users who have permissions to create and manage sites, domains, and subdomains to execute arbitrary code with root privileges via domain creation.

Impact Analysis

An attacker with the required permissions can exploit this vulnerability to execute arbitrary code as the root user, potentially leading to full system compromise, unauthorized access, data theft, or disruption of services.

Hi! I’m here to help you understand CVE-2025-66431. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70